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WHAT IS CLAIMED IS: 



1 1 . A system to maintain application data stored on a portable 

2 computer secure, the system comprising: 

3 an authorization client for use on the portable computer for making 

4 requests, the portable computer being capable of providing in-memory portions of 

5 address space for an application program; 

6 a security device to be associated with an authorized user of the 

7 portable computer and including an authorization server for supplying responses to 

8 the requests; 

9 a communication subsystem for wirelessly communicating the 

10 requests and the responses to the server and the client, respectively, within a range; 

11 and 

12 a cryptographic subsystem for encrypting data located in the in- 

13 memory portions of the address space to obtain corresponding encrypted data when 

14 the security device is outside the range of the communication subsystem and for 

15 decrypting the encrypted data when the security device is back within the range. 

1 2. The system as claimed in claim 1 wherein the requests include 

2 cryptographic requests for cryptographic information and wherein the server 

3 supplies the cryptographic information in response to the cryptographic requests and 

4 wherein the cryptographic subsystem utilizes the cryptographic information to either 

5 encrypt or decrypt the data. 

1 3. The system as claimed in claim 1 further comprising means 

2 for suspending substantially all authorized user processes on the computer when the 

3 security device is outside the range and means for restarting the suspended 

4 authorized user processes on the computer when the security device is back within 

5 the range. 

1 4. The system as claimed in claim 2 wherein the cryptographic 

2 information includes keys. 
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1 5. The system as claimed in claim 4 wherein the keys are 

2 encrypted. 

1 6. The system as claimed in claim 1 further comprising means 

2 for suspending selected authorized user processes on the computer when the security 

3 device is outside the range and means for restarting the selected authorized user 

4 processes on the computer when the security device is back within the range. 

1 7. The system as claimed in claim 1 further comprising a 

2 mechanism for establishing a binding between the portable computer and the 

3 security device to ensure that the security device only responds to a portable 

4 computer with a valid binding. 

1 8. The system as claimed in claim 1. wherein the security device 

2 is an authorization token. 

1 9. The system as claimed in claim 4 wherein the keys include at 

2 least one master key. 

1 10. The system as claimed in claim 9 wherein the at least one 

2 master key is a key-encrypting key. 

1 . 11. The system as claimed in claim 2 wherein the cryptographic 

2 subsystem includes encrypted keys and wherein the cryptographic information 

3 includes keys for decrypting the encrypted keys. 

1 12. A method to maintain application data stored on a portable 

2 computer secure, the method comprising: 

3 providing an authorization client for use on the portable computer for 

4 making requests, the portable computer being capable of providing in-memory 

5 portions of address space for an application program; 
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6 providing a security device to be associated with an authorized user 

7 of the portable computer and including an authorization server for supplying 

8 responses to the requests; 

9 wirelessly communicating the requests and the responses to the server 

10 and the client, respectively, within a range; 

1 1 encrypting data located in the in-memory portions of the address 

12 space to obtain corresponding encrypted data when the security device is outside the 

13 range; and 

14 decrypting the encrypted data when the security device is back within 

15 the range. 

1 13. The method as claimed in claim 12 further comprising 

2 suspending substantially all authorized user processes on the computer when the 

3 security device is outside the range and restarting the suspended authorized user 

4 processes on the computer when the security device is back within the range. 

1 14. The method as claimed in claim 12 wherein the requests 

2 include cryptographic requests for cryptographic information and wherein the server 

3 supplies the cryptographic information in response to the cryptographic requests and 

4 wherein the cryptographic information is used to either encrypt or decrypt the data. 

1 15. The method as claimed in claim 12 further comprising 

2 establishing a binding between the portable computer and the security device to 

3 ensure that the security device only responds to a portable computer with a valid 

4 binding. 

1 16. The method as claimed in claim 12 further comprising 

2 suspending selected authorized user processes on the computer when the security 

3 device is outside the range and restarting the selected authorized user processes on 

4 the computer when the security device is back within the range. 

1 17. The method as claimed in claim 14 wherein the cryptographic 

2 information includes keys. 
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1 18. The method as claimed in claim 17 wherein the keys include 

2 at least one master key. 

1 19. The method as claimed in claim 18 wherein the at least one 

2 master key is a key-encrypting key. 

1 20. An authorization token for use in a system to maintain 

2 application data stored in in-memory portions of address space on a portable 

3 computer secure, the token comprising: 

4 an authorization server for supplying encrypted responses to 

5 encrypted requests; and 

6 a transceiver for receiving the requests and transmitting the responses 

7 to the portable computer. 

1 21 . The token as claimed in claim 20 wherein the requests include 

2 cryptographic requests for cryptographic information and wherein the server 

3 supplies the cryptographic information in response to the cryptographic requests. 

1 22. The token as claimed in claim 21 wherein the cryptographic 

2 information includes keys. 

1 23., The token as claimed in claim 22 wherein the keys are 

2 encrypted. 

1 24. The token as claimed in claim 22 wherein the keys include at 

2 least one master key. 

1 25. The token as claimed in claim 24 wherein the at least one 

2 master key is a key-encrypting key. 
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